SEC Rule 613: Consolidated Audit Trail – National Market System (NMS) plan

Considerations for broker-dealers

2

Contents

What is SEC Rule 613? 3

Why was Rule 613 proposed? 3 What does CAT mean to broker-dealers? 4 Impact of CAT to broker-dealers: The challenge ahead 4 Next steps for broker-dealers 8

What is SEC Rule 613?1 The Securities and Exchange Commission (SEC) issued Rule 613 under Regulation NMS that requires the national securities exchanges and Financial Industry Regulatory Authority (FINRA) (collectively, self-regulating organizations or SROs) to submit an NMS plan (the plan) to create, implement, and maintain a consolidated audit trail (CAT). A primary purpose of the CAT is to address the lack of consolidated information available to regulators for market reconstruction and surveillance.

Once implemented, the CAT is expected to enhance regulators’ abilities to monitor and track trading activity and, in turn, help identify noncompliant trading activity in the market. Some of the requirements of the rule are to create a data repository of order, quote, and customer information to facilitate market reconstruction and surveillance, including: •Submission of all orders and quotes and associated

life cycle events from receipt or origination through execution or cancellation, including linkages within a single firm, across firms, and with exchanges

•Creation of unique customer identifiers and maintenance of customer information in order to identify account holders and persons authorized to trade for an account across broker-dealers.

Currently, the NMS plan is expected to be filed in December 2013 and the approved broker dealer interface specifications and protocols are expected to be published 12 months from the effective date of the plan. The NMS plan will initially cover NMS stocks and options and may eventually be extended to other security types. Based on the current timeline, large broker-dealers will be required to begin submitting data to the CAT by late 2015 or early 2016, while small broker-dealers2 will be required to begin submitting data by late 2016 or early 2017, depending on the plan approval by the SEC.

Why was Rule 613 proposed?3 Currently, regulators do not have ready access to comprehensive market data for surveillance, investigations, market reconstruction, and other regulatory activities. The existing surveillance tools and reports have various limitations, such as: •The Order Audit Trail System (OATS) does not include

trade or order activity that occurs on exchanges or at broker-dealers that are not FINRA or NASDAQ members

•Electronic blue sheets (EBS) provide information only on executed trades

•Large trader reporting (LTR) provides information only for trading activities of large traders

•Information provided to the Intermarket Surveillance Group (ISG) lacks uniformity in data submitted by participants and such data may not be validated

Additionally, these surveillance tools and reports do not identify the beneficial owners of the trade and some do not have a daily reporting requirement. The CAT is intended to be the industry utility that captures comprehensive order and quote life cycle data in one repository. The CAT is expected to improve the accuracy, completeness, availability, accessibility, and timeliness of order, quote, and trade data. The nature of the proposed implementation requirements for the CAT is expected to have a directly material impact across the securities industry.

1 Summarized from SEC Rule 613-Consolidated Audit Trail (CAT) SRO NMS Plan Industry Event, October 15 and 16, 2012 presentation. (http://www.catnmsplan.com/web/groups/catnms/@catnms/documents/catnms/p189514.pdf)

2 A small broker-dealer as defined in the Code of Federal Regulation CFR Title17 > Part 240>Subpart A, is a broker-dealer with total capital of less than $500,000 on the last business day of the preceding fiscal year and is not affiliated with any person (other than a natural person) that is not a small business or small organization (§ 240.0–10(c)).

3 Summarized from SEC Rule 613 – Consolidated Audit Trail. (http://www.sec.gov/rules/final/2012/34-67457.pdf).

"I can’t overestimate the importance of CAT — comprehensive public and non-public data about the market, coming from a single system, could be the most important regulatory development in my lifetime."

– Chairman Elisse B. Walter, former SEC Chairman, February 18, 2013

SEC Rule 613: Consolidated Audit Trail – National Market System (NMS) plan 3

What does CAT mean to broker-dealers?It is anticipated that compliance with the CAT requirements will have a significant impact on broker-dealers. Compliance with the CAT has the potential to: •Add to already-significant, regulatory-requirement

compliance costs

•Necessitate changes to client onboarding and other front-, middle-, and back-office processes

•Necessitate significant changes to trading order management systems, technology infrastructure, and data processing tools

•Increase concerns around client information security and privacy

•Increase data storage and retention requirements

•Change regulatory reporting requirements

•Require changes and enhancements to internal control policies and procedures

•Necessitate an increase in compliance awareness and training requirements across front-, middle-, and back-office functions

Accordingly, understanding and tracking the evolution of the CAT’s final design should be a significant discussion topic at the highest levels of senior executives at broker-dealers.

As the regulatory and compliance, operations, technology, and controls functions of broker dealers are expected to experience the greatest impact from the implementation of the rule, this paper highlights anticipated challenges broker-dealers are expected to face in these four areas. It also provides insights on how broker-dealers might prepare for these challenges and considerations broker-dealers should evaluate in preparation for the implementation of the rule.

Impact of CAT to broker-dealers: The challenges aheadRegulatory and compliance considerationsIt is anticipated that broker-dealers will incur significant incremental costs in addition to the already-significant costs currently incurred to comply with regulatory requirements. Some of these costs will stem from the enhanced reporting requirement of the CAT, which mandates that every order, quote, and event in the trade life cycle be reported to the CAT.

Exhibit 1 includes representative broker-dealer data that would be required to be submitted to the CAT, including the expected frequencies.4 Additional data may be requested as the plan is finalized, approved, and technical specifications are published.

Exhibit 1 only covers options and equities, which are included in the initial scope of the NMS plan. Additional securities are expected to be included in the scope of the CAT after the approval of the initial plan. Therefore, the solutions that broker-dealers consider for complying with the CAT requirement should be flexible and expandable to other products.

In addition to cost increases from changes or enhancement due to regulatory requirements, broker-dealers may incur some additional costs in the period following the implementation of the CAT due to the anticipated maintenance of parallel legacy reporting structures. Reporting requirements associated with EBS, OATS, and LTR are expected to overlap with Rule 613 requirements.5 It remains to be seen how quickly such parallel systems can or will be eliminated, as there are a number of requirements currently covered by the legacy reporting structures that are not included in the CAT. Industry participants have proposed a phased approach to implementing the CAT reporting

# Data type Product Description Frequency

1 Customer/account Equities/options Full submission of customer and account information Periodic

2 Customer/account Equities/options Changes/updates of customer and account information Daily

3 Market maker quotes Equities/options Market maker quotes submitted to exchanges, securities information processors or the FINRA alternative displace facility

Daily

4 Market participant information Equities/options Market participant identifiers and any associated information Daily

5 Order life cycle data Equities/options CAT reportable orders and all related order events received or originated by the broker-dealer

Daily

6 Self-help Equities/options Self-help declarations Daily

7 Sponsored access Equities/options Sponsored and direct market access (DMA) relationships and applicable market participant identifiers

Daily

4 Extracted from Consolidated Audit Trail (CAT) National Market System (NMS) Plan, Information for CAT Bidders, January 16, 2013. (http://www.catnmsplan.com/web/groups/catnms/@catnms/documents/appsupportdocs/p197697.pdf)

Exhibit 1: Representative broker-dealer data to be submitted to the CAT

5 See Securities and Exchange Commission (SEC) Rule 613 – Consolidated Audit Trail. (http://www.sec.gov/rules/final/2012/34-67457.pdf)

4

SEC Rule 613: Consolidated Audit Trail – National Market System (NMS) plan 5

requirements to allow time for necessary adjustments to be made. As such, there will likely be a period of overlap before the parallel systems are retired. Exhibit 2 offers a high-level comparison of OATS and the CAT.

Broker-dealers can also expect to incur additional costs from increased spending on training and awareness programs for their employees and customers.

How can broker-dealers prepare for the regulatory and compliance implications of the CAT?The implementation of the CAT is expected to necessitate updates to current compliance and risk management programs for many broker-dealers. Policies and procedures will probably need to be updated and documented; broker-dealers will likely need to have enhanced training procedures and communication protocols to educate personnel on the CAT requirements and the individual’s responsibility in helping the entity meet those requirements. Broker-dealers will also likely need to implement updated controls, reporting tools, and supervisory procedures for the ongoing monitoring of the accuracy, timeliness, and completeness of data submission to the CAT.

Additionally, from a risk management perspective, chief compliance officers, chief risk officers, and internal audit functions should consider incorporating the impact of CAT to their monitoring and oversight responsibilities. For example, when scoping and selecting areas to be tested, high priority should be given to areas impacted by the CAT (e.g., security and privacy, books and records, reporting on behalf of others, and outsourcing of reporting functions).

Operational considerationsThe implementation of CAT will likely lead to considerable systems implementation, enhancements, and/or modifications as well as lead to significant changes in business processes, such as customer onboarding procedures and customer data maintenance. At a minimum, broker-dealers may have to define new processes, identify resources, and expand their infrastructure to process and retain data for CAT compliance.

Other potential challenges include how broker-dealers will be able to comply with the CAT requirements as it relates to certain post-execution events, such as average price trades, execution allocations, transfers, give-ups/ins, and step-ins/outs. As it currently stands, broker-dealers acting in an executing capacity will be responsible for reporting to CAT, yet may not have access to all required post-execution data elements. In situations where a third party, such as a prime broker or clearing firm, possesses data necessary to complete the audit trail, the challenges have yet to be fully addressed. Industry participants have suggested that new reporting requirements be imposed on prime brokers and clearing firms, while others have suggested that executing brokers contract with third parties to link execution through terms and conditions of orders.6

An additional operational challenge relates to the submission of quotes. Under the rule, market makers will be required to submit quotation activity in addition to execution information. This is expected to be especially problematic for options markets, where quote activity away from the national best can be measured in millions for some broker-dealers.7 Industry associations, such as

# Data type OATS CAT (Rule 613)

1 Options Not in scope In scope

2 Over-the-counter equities In scope Not included in the initial phase

3 Link the audit trail execution reports for buy and sell orders to the public trade report

In scope Not in scope

4 Time stamp granularity Seconds At least to milliseconds

5 Market maker proprietary order submission Not in scope In scope

6 Customer information Not in scope In scope

7 Error correction timeline Reject-repair window is within five business days of final rejection delivery

Proposed reject-repair window is within three business days from the date the trade was executed

8 Exemptions for certain broker-dealers/firms In scope No exemptions

9 Exclusions of reporting firm members In scope No exclusions allowed

Exhibit 2: High-level comparison of OATS and the CAT

6 Summarized from SIFMA “Industry Recommendations for the Creation of a Consolidated Audit Trail (CAT)”, March 28, 2013, pg 43.

7 Summarized from Securities and Exchange Commission (SEC) Rule 613 – Consolidated Audit Trail. (http://www.sec.gov/rules/final/2012/34-67457.pdf)

the Securities Industry and Financial Markets Association (SIFMA), have advocated relying on exchanges to provide this data,8 but it remains unclear if this will gain traction with the SEC in its review of the plan.

Another operational challenge relates to the reporting of options transactions. Currently, broker-dealers have limited reporting requirements for options, i.e., there is no OATS-equivalent requirement. Options reporting will probably be a significant undertaking for broker-dealers as they may be required to enhance or build new systems to generate the reports for the options quotes, orders, and executions.

How can broker-dealers prepare for the operational implications of the CAT?Broker-dealers should begin to identify how their current operations will be impacted by the CAT requirements, including technology platforms and reporting procedures. In addition, firms should review dependencies upon external systems or vendors and begin to confirm potential gaps in reporting procedures or issues of data integrity within key customer information databases. Similarly, firms should review customer account mappings across different product groups for consistency and assess the completeness of customer data as currently maintained against the data elements required by the rule. In addition, as broker-dealers formulate their future state operational strategies (e.g., mergers and acquisitions, offshoring) consideration should be given to the potential requirements of the CAT.

Broker-dealers should stay current on additional requirements that may be imposed on prime brokers and clearing firms and proposed actions to be taken by executing brokers to facilitate the linkage of execution and post-execution order events.

Finally, broker-dealers can start identifying infrastructure, processes, and procedures that may need to be updated for tracking order changes, aggregation, and/or disaggregation of trades to facilitate proper matching and linkage of broker-dealers’ and exchanges’ data submissions.

Technology considerationsAlthough the protocols and interface specification required by broker-dealers for submission of data to the CAT are not expected to be published until late 2014 or early 2015, the implementation for CAT compliance is expected to have a significant impact on broker-dealers’ data management, data quality and governance, and technology infrastructure, contributing to the increased cost that broker-dealers are expected to incur. The implementation of the CAT compliance requirements will likely necessitate significant changes to systems and data processing, transmission, and reporting tools. Broker-dealers may also require additional resources and will have a relatively short system development and implementation time frame, as large broker-dealers would be expected to begin submitting data to the CAT 12 months after the technical specifications for broker-dealer submission are released.

Another area that will be impacted is the time stamp requirement for orders and other relevant reportable events, which is defined to at least milliseconds.9 This may necessitate changes to systems as current requirements only mandate reporting to seconds. Additionally, based on the current timeline, broker dealers will be required to synchronize their clocks to the National Institute of Standards and Technology within four months of the approval of the NMS plan.

How can broker-dealers prepare for the technology implications of the CAT?Prior to the anticipated late-2014/early-2015 release of the technical specifications and protocols for CAT reporting, broker-dealers can begin to evaluate how well their current data management procedures and infrastructure can support the Rule 613 requirements by performing a gap analysis gap analysis.

Given the volume of data to be reported to the CAT and the data retention requirements (broker-dealers will be required to retain and store at least five years of data submitted to the CAT), broker-dealers should begin evaluating their options for enhancing their current infrastructure to significantly increase their systems processing, database, and data storage capacity.

8 SIFMA Industry Recommendations for the Creation of a Consolidated Audit Trail (CAT), March 28, 2013, pg 15.9 Summarized from Securities and Exchange Commission (SEC) Rule 613 – Consolidated Audit Trail.

(http://www.sec.gov/rules/final/2012/34-67457.pdf)

6

Also, once the data submission specifications are defined for the CAT processor, broker-dealers will likely need to build and/or enhance their infrastructure to prepare, test, and submit data to the CAT. In order to meet the aggressive timeline to meet the error-handling process, it will be very critical for broker dealers to have a robust process in place to ensure the data linkage is thoroughly tested for various order handling scenarios as orders, executions, and allocations flow through various systems within the firm.

Broker-dealers also need to begin evaluating and enhancing their systems to ensure that the transmission of personally identifiable information (PII) to the CAT will be properly encrypted and sent via a secure mechanism.

Lastly, broker-dealers should leverage the lead-time before the CAT is fully implemented to ensure that their current customer master databases are accurate, complete, and that the necessary controls are in place.

Risk and control considerationsThe first few years after the implementation of the CAT will likely involve some risks, as other industry-changing initiatives have in the past. As such, broker-dealers may require changes and enhancements to existing internal control policies and procedures in order to mitigate some of the operational, compliance, legal, and reputational risks associated with the implementation of the CAT.

Broker-dealers will need to implement controls designed to ensure all reportable events (e.g., trade orders, routes, executions, cancels, modifications, market quotes, and error correction) are captured and linked accurately in front-, middle-, and back-office processes and systems to completely report to the CAT by the mandated deadlines.

One of the major areas where additional controls may be required is customer account maintenance and data transmission. Broker-dealers are expected to transmit PII, which would be used to uniquely identify customers and link trades across accounts, broker-dealers, and exchanges. As such, controls relating to data file security, accuracy, and privacy will probably become more critical to many broker-dealers.

How can broker-dealers prepare for the risk and control considerations of the CAT?Broker-dealers should use the time before the CAT is implemented to prepare their systems and inventory their controls to ensure they can provide accurate and complete data to the CAT. A review of their current controls, procedures, and system limitations would be beneficial to determine how much additional work and funding is necessary to meet the demands of the CAT and manage any associated risks. In order to be able to provide accurate and complete data to the CAT by the established timelines, broker-dealers should assess their current controls and define new ones necessary in connection with any anticipated processes, systems, and infrastructure that may be deployed.

Areas where policies and procedures may need to be updated and additional controls implemented include, but are not limited to, client onboarding, customer/account maintenance, trade/account reconciliations, date storage, and data transmission to the CAT. Broker-dealers will have to submit an initial file of existing accounts, including the identity of each customer as well as updates for new accounts and account changes/deletions on a daily basis. Therefore, the implementation of strong data security and privacy policies and procedures, covering internal data processing and external data transmissions, may be of particular importance from a legal and reputational risk perspective.

SEC Rule 613: Consolidated Audit Trail – National Market System (NMS) plan 7

Next steps for broker-dealers In anticipation of the finalization of the rules and implementation details, there are various steps that broker-dealers can take to prepare as outlined above (and summarized in Exhibits 3 and 4). In general, broker dealers should consider establishing a program management office (PMO) to ensure that all interdependencies across technology, compliance,

Assessment Analysis Plan implementation

Technology • Inventory current portfolio of front-, middle-, and back-office systems and tools (related to trading life cycle, customer information)

• Identify any vendor dependencies and potential enhancements to vendor packages

• Identify options or limitations of current proprietary tools and technology infrastructure, data governance/integrity, and security to support CAT requirements

• Identify current data storage limitations, considering that CAT requires five years of data retention

• Perform preliminary gap analysis between CAT requirements, current regulatory reporting data requirements, and supporting systems/technology infrastructure

• Perform preliminary cost analysis and estimated development and testing time required for CAT technology updates/implementation, including business clock synchronization

• Perform preliminary evaluation of the additional cost that will be required to support multiple reporting systems (e.g., LTR, EBS, OATS) until those systems are decommissioned

• Include CAT in strategy discussions and include planning for it in technology projects and investments for the next two to four years

• Evaluate options to add or modify existing systems and data sources to capture CAT-relevant data elements for regulatory reporting compliance in order to mitigate data governance/integrity issues and minimize downstream data reconciliations

• Assess options to leverage existing processes and systems to minimize the cost impact

Operations • Perform initial assessment of CAT impact on front-, middle-, and back-office operations and processes

• Assess the current processes to link customer data, accounts, orders modifications/cancellations, trade executions, and allocations

• Review client onboarding process and determine completeness of data to be submitted to the CAT under Rule 613

• Identify gaps between customer data submissions and current data captured during customer onboarding process

• Identify gaps between CAT reporting requirements and different order handling scenarios: agency, riskless principal, average price account, order aggregation and disaggregation, subaccount allocations

• Establish PMO to make sure all the operational interdependencies are considered for timely implementation of CAT requirements

• Evaluate options to link data as required for CAT reporting to minimize data linking errors

• Plan for any potential reconciliations that may be required

• Plan for additional manpower support that may be required to support CAT and its error processing timelines thresholds

Risk and controls

• Identify current data, controls issues, or new additions across order lifecycle processes

• Assess current Know Your Customer (KYC) procedures considering CAT requirements for customer identification

• Perform preliminary gap analysis between CAT requirements and current data quality and regulatory reporting risk and controls procedures

• Identify additional data analytics capabilities that will be needed to monitor compliance

• Assess process to include KYC information in the customer data submission to the CAT

• Incorporate CAT oversight responsibilities in the agenda of chief compliance officers and chief risk officers

Exhibit 3: Prework broker-dealers can perform before technical specifications are available

operations, legal, risk, and internal audit are considered for the timely implementation of the CAT requirements. Since the rule is expected to be extended to other products as early as six months after the approval of the first plan, broker-dealers should plan well ahead, so that whatever solution they develop to meet the initial requirements of the CAT is easily expandable to other products.

8

Assessment Analysis Plan implementation

Technology • Assess impact of the technical specifications and requirements

• Identify systems/platform that may need to be added, changed, or updated

• Evaluate current or new data storage, security requirements, data management procedures, and processing capabilities considering technical specifications for data submission to the CAT

• Perform detailed gap analysis focused on data processing and storage capabilities, systems, and technical infrastructure

• Update cost analysis for CAT implementation

• Develop an implementation plan, including development, testing, and production of new or updated systems and updates of vendor packages

• Develop implementation plan for data transmission to the CAT, including data security and privacy considerations

• Develop CAT data preparation and submission tools

• Perform integration testing of tools and processes with the CAT over a phased period

• Develop data analytics capabilities to detect exceptions and monitor compliance with CAT requirements

Operations • Assess the effectiveness of enhanced processes implemented in the pre-work stages against the technical specification to manage data errors

• Identify shortcomings in current processes and assess other options to manage error detections, reconciliations, and corrections

• Estimate efforts and resources needed in order to comply with data submission time frame and proposed error correction timeline

• Develop and implement new processes to implement the front-, middle-, and back-office operation changes to minimize the data errors and corrections

• Develop operational procedures for data reporting and error-correction handling

Risk and controls

• Identify risk tolerance levels, additional data quality processes and technology controls that may need to be implemented to mitigate regulatory reporting risks in the new environment

• Update gap analysis between CAT requirements and current regulatory reporting risk and controls procedures

• Update compliance and risk management programs, including: (i) update policies and procedures; (ii) communicate and train personnel about new requirements and their associated responsibilities; and (iii) develop reports for the ongoing monitoring of the accuracy, timeliness, and completeness of data submissions

• Establish CAT regulatory reporting and compliance governance structure

• Implement strong data security and privacy policies and procedures covering internal and external data transmissions

• Implement new controls identified during gap analysis

Exhibit 4: Readiness work broker-dealers may perform when technical specifications are available

SEC Rule 613: Consolidated Audit Trail – National Market System (NMS) plan 9

ContactsSusan Levey Director Deloitte & Touche LLP +1 212 436 2659 slevey@deloitte.com

Graeme Smith Director Deloitte & Touche LLP +1 212 436 3191 grsmith@deloitte.com

Robert WalleyPrincipalDeloitte & Touche LLP+1 212 436 3212rwalley@deloitte.com

Claudia Moreno Senior Manager Deloitte & Touche LLP +1 212 436 4147 clamoreno@deloitte.com

Adetokunbo “Toks” Olabisi Senior Manager Deloitte & Touche LLP +1 404 631 3345 aolabisi@deloitte.com

Gowri Zoolagud Senior Manager Deloitte & Touche LLP +1 617 437 3235 gzooglaud@deloitte.com

10

Disclaimer The views presented in the paper are based on information currently available and are subject to change based on the finalization of the NMS plan and issuance of the approved broker dealer interface specifications and protocols.

This document contains general information only and Deloitte is not, by means of this document, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This document is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte shall not be responsible for any loss sustained by any person who relies on this document.

About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.

Copyright © 2013 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited